Skip to content

Commit 25b6937

Browse files
benskelkerbenskelker
authored
[Docs][SIEM] Cases UI docs (#967) (#980)
* intial case api docs * starts updating the api * updates patch comments * api updates * starts conf api * more conf api stuff * minor fixes * more updates * proofing * typo * formatting * gets rid of me * adds delete all comments method * corrections after feedback * corrections 2 * corrections continued * cmore corrections * and more corrections * even more * rebase * adds reporters to find * corrections * corrections II * connector corrections * final corrections * starts cases ui * image and stuff * open and manage cases * connectors * proofing and ui overview * starts corrections * corrections * more corrections
1 parent 964419c commit 25b6937

8 files changed

+133
-2
lines changed

‎docs/en/siem/cases-overview.asciidoc

+61-2
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,65 @@
11
[[cases-overview]]
22
[role="xpack"]
33

4-
= Cases
4+
= Cases (Beta)
55

6-
// Placeholder
6+
beta[]
7+
8+
Cases are used to open and track security issues directly in the {siem-app}.
9+
They list the original reporter and all users who contribute to a case
10+
(`participants`). Comments support markdown syntax, and allow linking to saved
11+
<<timelines-overview, Timelines>>. Additionally, you can send cases to external
12+
systems from within the {siem-app} (currently {sn}). <<cases-ui-integrations>>
13+
describes how to set this up.
14+
15+
You can create and manage cases via the UI or the <<cases-api-overview>>.
16+
17+
IMPORTANT: To make sure you can view and open cases, see <<case-permisions>>.
18+
19+
[role="screenshot"]
20+
image::images/cases-ui-home.png[]
21+
22+
[float]
23+
[[cases-ui-open]]
24+
== Open a new case
25+
26+
Open a new case to keep track of security issues and share their details with colleagues.
27+
28+
. Go to *SIEM* -> *Cases* -> *Create new case*.
29+
. Give the case a name, and add a description and any relevant tags.
30+
+
31+
TIP: In the `Description` area, you can use
32+
https://www.markdownguide.org/cheat-sheet[markdown] syntax and insert a
33+
timeline link (click the icon in the top right corner of the area).
34+
35+
. When ready, create the case.
36+
. If external connections are configured, you can send the case to {sn}.
37+
38+
[role="screenshot"]
39+
image::images/cases-ui-open.png[]
40+
41+
[float]
42+
[[cases-ui-manage]]
43+
== Manage existing cases
44+
45+
You can search existing cases, and filter them by tags, reporter, and status
46+
(open or closed).
47+
48+
To view a case, click on its name. You can then:
49+
50+
* Add a new comment.
51+
* Edit existing comments and the case's description.
52+
* Send updates to {sn} (if external connections are configured).
53+
* Close the case.
54+
* Reopen a closed case.
55+
* Edit tags.
56+
* Refresh cases to retrieve the latest updates.
57+
58+
[float]
59+
[[case-permisions]]
60+
== Cases prerequisites
61+
62+
To view cases, you need the {kib} space `Read` privilege for the Saved Objects
63+
Management feature. To create cases and add comments, you need the `All` {kib}
64+
space privilege for the Saved Objects Management feature. For more information,
65+
see {kibana-ref}/xpack-spaces.html#spaces-control-user-access[Feature access based on user privileges].

‎docs/en/siem/cases-ui-integrations.asciidoc

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
[[cases-ui-integrations]]
2+
[role="xpack"]
3+
== Configuring external connections
4+
5+
You can push new cases and case updates to {sn}. To do this, you need to create
6+
a connector, which stores the information required to push cases to {sn} via
7+
{sn}'s https://developer.servicenow.com/dev.do#!/reference/api/madrid/rest/c_TableAPI[Table API].
8+
After you have created a connector, you can set {siem-soln} cases to close
9+
automatically when they are sent to {sn}.
10+
11+
[float]
12+
=== Create a new connector
13+
14+
. Go to *SIEM* -> *Cases* -> *Edit external connection*.
15+
+
16+
[role="screenshot"]
17+
image::images/cases-ui-connector.png[]
18+
. Click `Add new connector option`, and then click {sn}.
19+
+
20+
[role="screenshot"]
21+
image::images/cases-ui-sn-connector.png[]
22+
. Fill in the following:
23+
* _Connector name_: A name for the connector.
24+
* _URL_: The URL of the {sn} instance to which you want to send cases.
25+
* _Username_: The username of the {sn} account used to access the {sn}
26+
instance.
27+
* _Password_: The password of the the {sn} account used to access the {sn}
28+
instance.
29+
. To represent a SIEM case as a {sn} incident, these SIEM case fields are
30+
mapped to {sn} incidents fields as follows:
31+
** `Title`: Mapped to the {sn} `Short description` field. When an update to a
32+
SIEM case title is sent to {sn}, the existing {sn} `Short description` field is
33+
overwritten.
34+
** `Description`: Mapped to the {sn} `Description` field. When an update to a
35+
SIEM case description is sent to {sn}, the existing {sn} `Description` field is
36+
overwritten.
37+
** `Comments`: Mapped to the {sn} `Comments` field. When a comment is updated
38+
in a SIEM case, a new comment is added to the {sn} incident.
39+
. Save the connector.
40+
41+
[float]
42+
=== Close sent cases automatically
43+
44+
To close cases when they are sent to {sn}, select the
45+
_Automatically close SIEM cases when pushing new incident to third-party_
46+
option.
47+
48+
[float]
49+
=== Change and update connectors
50+
51+
You can create additional connectors, update existing connectors, and change
52+
the connector used to send cases to {sn}.
53+
54+
. To change the connector used to send cases to {sn}:
55+
.. Go to *SIEM* -> *Cases* -> *Edit external connection*.
56+
.. Select the required connector from the `Incident management system` list.
57+
. To update an existing connector:
58+
.. Click `Update connector`.
59+
.. Update the the connector fields as required.

‎docs/en/siem/images/cases-ui-connector.png

362 KB
Loading

‎docs/en/siem/images/cases-ui-home.png

328 KB
Loading

‎docs/en/siem/images/cases-ui-open.png

341 KB
Loading

‎docs/en/siem/images/cases-ui-sn-connector.png

127 KB
Loading

‎docs/en/siem/index.asciidoc

+2
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,8 @@ include::prebuilt-rules-changelog.asciidoc[]
6363

6464
include::cases-overview.asciidoc[]
6565

66+
include::cases-ui-integrations.asciidoc[]
67+
6668
include::cases-api.asciidoc[]
6769

6870
include::cases-api-create.asciidoc[]

‎docs/en/siem/siem-ui.asciidoc

+11
Original file line numberDiff line numberDiff line change
@@ -178,6 +178,17 @@ according to various attributes, including `Risk scores`, `Severities`, and
178178
`Top event categories`. The `All signals` table helps with investigations,
179179
allowing you to search, filter, and aggregate all {siem-soln} signals.
180180

181+
[float]
182+
[[cases-ui]]
183+
=== Cases
184+
185+
The Cases page is used to open and track security issues directly in the
186+
{siem-app}. For information on how to open and manage cases, see
187+
<<cases-overview>>.
188+
189+
[role="screenshot"]
190+
image::images/cases-ui-home.png[]
191+
181192
[float]
182193
[[timelines-ui]]
183194
=== Timelines

0 commit comments

Comments
 (0)